Network architectures for observing and capturing information about network traffic in a datacenter are described herein. Network traffic coming out of a compute environment (whether from a container, VM, hardware switch, hypervisor or physical server) is captured by entities called sensors or capture agents that can be deployed in or inside different environments. Sensors export data or metadata of the observed network activity to collection agents called “Collectors.” Collectors can be a group of processes running on a single machine or a cluster of machines. For the sake of simplicity, collectors can be treated as one logical entity and referred to as one collector. In actual deployment on the datacenter scale, there will be more than just one collector, each responsible for handling export data from a group of sensors. Collectors are capable of doing preprocessing and analysis of the data collected from sensors. The collector is capable of sending the processed or unprocessed data to a cluster of processes responsible for analysis of network data. The entities which receive the data from the collector can be a cluster of processes, and this logical group can be considered or referred to as a “pipeline.” Note that sensors and collectors are not limited to observing and processing just network data, but can also capture other system information like currently active processes, active file handles, socket handles, status of I/O devices, memory, etc.
A network will often experience different amounts of packet loss at different points within the path of a flow. It is important to identify the amount of packet loss at each point to fine tune and improve the network. Current solutions implement a request/reply model when trying to identify packet loss at different points. In this approach, a system will send a request at each point and will identify packet loss if a reply is not received. However, this model cannot be implemented in a live environment. Moreover, this model is not as efficient or accurate as it can lead to additional network traffic and be subject to errors.